[YARN-2198] Remove the need to run NodeManager as privileged account for Windows Secure Container Executor

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.6.0
• Labels: security windows
• Target Version/s: 2.6.0
• Hadoop Flags: Reviewed
• Assignee: Remus Rusanu
• Reporter: Remus Rusanu
• Created: 24/Jun/14 11:19
• Updated: 26/Feb/15 21:54
• Resolved: 22/Oct/14 23:27

Description

YARN-1972 introduces a Secure Windows Container Executor. However this executor requires the process launching the container to be LocalSystem or a member of the a local Administrators group. Since the process in question is the NodeManager, the requirement translates to the entire NM to run as a privileged account, a very large surface area to review and protect.

This proposal is to move the privileged operations into a dedicated NT service. The NM can run as a low privilege account and communicate with the privileged NT service when it needs to launch a container. This would reduce the surface exposed to the high privileges.

There has to exist a secure, authenticated and authorized channel of communication between the NM and the privileged NT service. Possible alternatives are a new TCP endpoint, Java RPC etc. My proposal though would be to use Windows LPC (Local Procedure Calls), which is a Windows platform specific inter-process communication channel that satisfies all requirements and is easy to deploy. The privileged NT service would register and listen on an LPC port (NtCreatePort, NtListenPort). The NM would use JNI to interop with libwinutils which would host the LPC client code. The client would connect to the LPC port (NtConnectPort) and send a message requesting a container launch (NtRequestWaitReplyPort). LPC provides authentication and the privileged NT service can use authorization API (AuthZ) to validate the caller.

Issue Links

• breaks: YARN-2803 MR distributed cache not working correctly on Windows after NodeManager privileged account changes.
• breaks: HADOOP-11639 Clean up Windows native code compilation warnings related to Windows Secure Container Executor.
• breaks: HADOOP-11280 TestWinUtils#testChmod fails after removal of NO_PROPAGATE_INHERIT_ACE.
• is part of: YARN-732 YARN support for container isolation on Windows
• is required by: YARN-2391 Windows Secure Container Executor helper service should assign launched process to the NM job
• is required by: HADOOP-11080 Convert Windows native build in hadoop-common to use CMake.
• is required by: YARN-2687 WindowsSecureContainerExecutor hadoopwinutilsvc is difficult to troubleshoot
• is required by: YARN-2636 Windows Secure Container Executor: add unit tests for WSCE
• relates to: YARN-1972 Implement secure Windows Container Executor
• relates to: HDFS-6699 Secure Windows DFS read when client co-located on nodes with data (short-circuit reads)
• relates to: YARN-2357 Port Windows Secure Container Executor YARN-1063, YARN-1972, YARN-2198 changes to branch-2
• requires: YARN-1972 Implement secure Windows Container Executor

Sub-Tasks

• Add file handling features to the Windows Secure Container Executor LRPC service: Resolved
• document the wsce-site.xml keys in hadoop-yarn-site/src/site/apt/SecureContainer.apt.vm: Resolved
• Fix WSCE folder/file/classpathJar permission/order when running as non-admin: Resolved
• The elevated WSCE LRPC should grant access to the jon to the namenode: Resolved
• Windows Secure Container Executor helper service should assign launched process to the NM job: Resolved
• Windows Secure Cotnainer Executor: Add checks to validate that the wsce-site.xml is write restricted to Administrators only: Resolved
• Windows Secure Container Executor: the privileged file operations of hadoopwinutilsvc should be constrained to localdirs only: Resolved
• Windows Secure Container Executor: assign PROCESS_TERMINATE privilege to NM on created containers: Resolved
• Windows Secure Container Executor: grant job query privileges to the container user: Resolved
• Windows Secure Container Executor: use elevated file system operations to cleanup the containers: Resolved
• Windows Secure Container Executor: classpath in the job classpath-jar is referencing NM nmPrivate files: Resolved
• Windows Secure Container Executor: containerLaunch environment does not get transferred to the container process: Resolved